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C. Introduction 



Accident Summary 

On the evening of Sunday, July 25 2010, at approximately 5:58 p.m. 1 , a 40-foot 
long pipe segment in Line 6B, located approximately 0.6 of a miles downstream of the 
Marshall, Michigan pump station, ruptured. The Line 6B is owned and operated by the 
Enbridge Energy Inc. (Enbridge). The Enbridge control center in Edmonton, Alberta 
Canada was in the final stages of executing a scheduled shutdown of their 30-inch 
diameter crude oil pipeline (Line 6B) when the rupture occurred. The initial and 
subsequent alarms associated with the rupture were not recognized as a line-break 
through two start-up attempts and over multiple control center shifts. Residents near the 
rupture site began calling the Marshall City 911 dispatch center to report odors at 9:25 
p.m. on Sunday; however, no calls were placed to the Enbridge control center until 11:17 
a.m. the following day. Once the Enbridge control center was notified, nearly 17-hours 
after the initial rupture, remote controlled valves were closed, bracketing the ruptured 
segment within a three-mile section. 

The accident resulted in an Enbridge reported release estimate of 20,082 barrels 
(843,444 gallons) of crude oil with no injuries or fatalities. The rupture location is in a 
high consequence area within a mostly rural, wet, and low-lying region. The released oil 
pooled into a marshy area over the rupture site before flowing 700 feet south into 
Talmadge creek which ultimately carried it into the Kalamazoo River. 

Line 6B was constructed in 1969 as a 293-mile long extension of the Lakehead 
pipeline system, stretching from Griffith, Indiana to Sarnia, Ontario. The failed segment 
was a cathodically protected, tape coated pipe manufactured by Italsider s.p.a. per the 
1968 API 4 Standard 5LX Specification for High-Test Line Pipe X52 specification with 
0.25-inch thick wall and a double submerged arc welded (DSAW) longitudinal seam. 
The maximum operating pressure (MOP) for Line 6B was 624 psig; however, at the time 
of the accident, Marshall Station discharge pressure was limited to 523 psig due to a 2009 
Enbridge imposed pressure restriction between Stockbridge and Sarnia. The maximum- 
recorded discharge pressure at Marshall, prior to the rupture, was 486 psig. 

Lake-Head Pipeline and Line 6B System 

Line 6B consists of seven active pumping stations 5 (figures la, lb, & lc) with 
tankage at various locations between Griffith, Indiana and Sarnia, Ontario, Enbridge uses 
a computation pipeline model (CPM) for detecting leaks on Line 6B. The type of CPM 
used is a Real Time Transient Model. At Enbridge, this model is referred to internally as 
the Material Balance System or MBS. The MBS utilizes three volume balance calculation 
time periods for detecting leaks. The two volume balance sections at the time of this 



1 All times are expressed in local accident time, Eastern Daylight Time. 

2 As defined by PHMSA under 49CFR§ 195.450. 

3 Societa Per Azioni (Italian). The Italsider pipe was purchased from Siderius Inc. of New York. 

4 American Petroleum Institute, New York, New York 

5 See Appendixes and Figures: la, lb, & lc 
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accident are Griffith to Marshall (GTMR), and Marshall to Sarnia (MRRW) 6 . 



Active Pump Station 


Approx. Mile Post 


Approx. Elevation (feet asl) 


(Griffith Terminal) Active 


465.6 


628 


(LaPorte Station) Active 


499.4 


792 


(Niles Station) Active 


538.2 


796 


(Mendon Station) Active 


576.9 


840 


(Marshall Station) Active 


607.6 


920 


(Stockbridge) Active 


650.6 


950 


(Howell Station) Active 


678.7 


971.8 


Figure: la Enbridge Energy Line 6B Active Pump Stations 
Source: Enbridge Energy. 


on July 25 & 26, 2010, 




Figure: lb Enbridge Energy Pipeline System Map from Edmonton, Canada to Montreal, 
Canada, Source: Enbridge Energy. 



See Attachment: 34 Line 6B Volume Balance Sections. 
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Enbridge 6B Pipeline 
O Pump Station Activated 
O Pump Station Deactivated 
O Terminal Activated 
• Nearby City/Town 



Figure: 1c Enbridge Energy Line 6B System Map from Griffith to Sarnia, Source: 
Enbridge Energy. 

C. Control Center 

The Enbridge Energy, Inc, SCADA control center was located in downtown 
Edmonton, Alberta Canada. There were a total of twenty-five personnel comprising a 
shift. This included twenty-two line and terminal Operators, two Shift Leads, and one 
Material Balance System (MBS) Analyst (see figure 1). The supervisors and 
management are located in an area away from the control center. There was one Control 
Center Operation Supervisor responsible for the control center operation and shift lead 
group and another Control Center Operation Supervisor responsible for the oversight of 
the technical services group. The two shift leads are the acting supervisors of the control 
center overseeing the twenty-two consoles and also answering all emergency calls into 
the control center . During interviews the shift leads indicated that there is an informal 
arrangement where one shift lead will oversee the pipeline operators while the other 
oversees the terminal operators. According to statements by the Control Center 
Operation Supervisor the role of the shift lead is to help the operators' trouble shoot 
issues that arise on the pipeline by prompting the operators to ask key questions and to 
follow procedures. The shift leads are not expected to be the technical experts in the 
room. The structure of the control center established by Enbridge puts the technical 



7 See Operator Al interview transcript of July 28, 2010 
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expertise of pipeline operation at the operator level. According to interview statement 
from the control room supervisor, the control room operator has the ultimate authority to 
shutdown the pipeline if they believe conditions are unsafe. 

The operator runs the pipelines assigned to their console. Each operator is 
responsible for multiple pipelines from their console. This can vary from 2 to 5 lines 
depending on the complexity of the operation. Line 6B was operated from a console 
along with lines 3, 6A, and 17. According to Enbridge control room supervisor, the 
control center operators are placed in groups consisting of back to back consoles or 
"pods" such as lines 4 and 6B. Line 4 was operated from the console directly behind 
Line 6B making the 4 and 6B consoles a group. According to the control room 
supervisor each group consists of two operators that are to act as a technical resource for 
one another when problems arise. Within the control center there are several large flat 
screen panels within view of all the controllers. The intent is that problems on any line 
may be displayed on the screens for the entire room to troubleshoot or discuss. The Line 
6B console, according to statements in the interviews, was one of the more difficult 
consoles to operate. 

The pipeline operators perform startup and shut downs on the pipeline and ensure 
that adequate flow rates are maintained and that scheduled deliveries are made to the 
terminal locations. The pipeline operators have to monitor multiple batches of crude in 
the line and work closely with terminal operators at other consoles to see that they are 
delivered correctly. Every two hours the controller performs an automatic balance 
calculation using the commodity tracking system to double check deliveries. To maintain 
the correct flow rate on the line, the operator must manage pressure set points at the 
pump stations, valve positions, starting and stopping pumps within a station, setting 
pump speeds or holding pressure at the delivery tanks. When the system is running, the 
operator observes changes in the pressure through the color and number indications that 
appears on the line display 

The control center operator must also monitor the alarm screen and historical 
SCAD A data (events log) which tracks commands, acknowledge high priority alarms of 
S4-S8 and monitor low priority notifications of S2-S3. 

The operators most times when they receive status alarms of any form 
communicates to the Shift Lead, and sometimes with the MBS Analyst, they take the 
MBS Analyst interpretations of the MBS as being conclusive and may or may not 
conduct further investigations. 
See attachments [2 - 3] 
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Figure: Id [Attachment 1] 

The role of the Material Balance Analyst is to serve as the systems expert over the 
leak detection software system. The MBS analyst is contacted by the shift lead or 
operator when a material balance alarm is received. According to interviews transcripts 
of Material Balance Analyst A their function is to tell the operator the result of their 
analysis, make sure the software is maintained and running the way it should. The MBS 
system involves examining several screens to make a determination as to whether the 
model is working properly or not. The MBS analyst and operator have access to similar 
MBS displays; however, according to statements by operators they are not trained to use 
the material balance system. 

If the MBS analyst requires further technical support, there is an on-call twenty- 
four hours seven days a week MBS engineer that may be contacted . 

A control center operator typically operates more than a single pipeline. Line 6B 
console included lines 3, 6A, and 17 as well as line 6B. Shifts could be morning to 



Interview of Control Center Engineer on July 30, 2010 
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evening with each shift covering al2 hour span beginning at 6:00 a.m. to 6: p.m. vice 
versa, local time. 
See Attachment [22] 

D. Incident Overview 

Description of Line 6B Pre-Shut down, Shutdown and Start-up events 

Shift A - July 25, 2010 

On July 25, 2010 at about 8:00 a.m. shift A, started as a normal day shift with 
Operator Al and Operator A2 overseeing Line 6B which was already running. 
Operator Al was a control room operator with 29 years of experience in pipeline 
operation that had just started re-qualification to the control center full time after being 
away from the control center for 6 months on disability leave and was being mentored by 
another controller, Operator A2 with 30 years of experience as a pipeline operator. 

A planned shutdown of Line 6B had been scheduled from 7:30 p.m. July 25, 2010 
to 4:00 a.m. on July 26th. At the suggestion of Operator Al who had concerns over the 
scheduled conflict shutdown, Shift Lead A2 contacted schedule department about the 
time as a result it led to a combination of two start-ups and shut downs as originally 
scheduled; the shutdown was moved one hour earlier from 6:30 p.m. July 25, 2010 to 
4:00 a.m. July 2010 9 . 

At 1 1:24 a.m. an Electrician A spoke with Operator Al to find out when the In- 
line Inspection tools (pigs) 10 in Line 6B would be at the Niles pump station so that he 
could bypass the station. Line 6B was scheduled to be shut down at 6:00 p.m. and re- 
started at 4:00 a.m. on July 26, 2010, the reason for the shutdown was due to 
unavailability of oil in tanks at Griffith to ship. Enbridge planned to have the entire 
quantity of oil at the location before they resume pumping when the customer would 
receive it. This was stated as scheduled delivery conflict 11 . 

At 5:37 p.m. Electrician A called Operator Al and told him he was heading to 
Niles Station to be ready for the bypass, and by 6:08 p.m. Niles Station was bypassed for 
pigs' passage, the required valves were closed, and locked out. 

According to Enbridge SCAD A data log report and Operator Al interview 
transcripts, at 5:55 p.m., as part of the planned shutdown, he talked to the terminal 
operator to stop the booster pump at Griffith, then issued a stop command to the first of 
two pumps at the most upstream station; Griffith. At 5:56 p.m. the second pump at 
Griffith was given a stop command. Within seconds of stopping the second pump at 
Griffith, Operator Al issued a stop command to the pump at La Porte, the next 
downstream station. 



9 Enbridge Control Center Transcript at 4:34 p.m. on July 25, 2010 

10 Pig, this is an In-line Inspection tool for pipeline cleaning and inspection 

11 Enbridge Control Center Transcript at 4:34 & 4:36 p.m. on July 25, 2010 
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According to Enbridge SCADA data log report at 5:57 p.m. Operator Al 
increased the holding pressure to 200 psig at Stockbridge, delivery location after pressure 
reduction on Line 6B due to set point changes. Within seconds of changing the holding 
pressure set point, Operator Al issued a stop command to the only pump at the Niles 
Station. In preparation for stopping pumps at Mendon, Operator Al reduced the suction 
pressure set point by 5 psig at the Mendon and Marshall Pump Stations. 

At 5:58 p.m. Operator Al issued a stop command to pump Unit-1 the Mendon 
Pump Station approximately 40 miles upstream of the Marshall station. Within seconds 
of stopping the pump at Mendon, at 5:58 p.m., Operator Alreceived a high priority alarm 
from the Marshall Station indicating invalid pressure from the Line Pressure 

12 

Monitor(LPM) system which according to Enbridge it implies the transmitter received a 
zero pressure. Operator Al also issued a stop command to pump Unit-2 at Marshall. At 
the same time that the high priority alarm was received, there was a medium priority 
13 alarm at the Marshall station, the final downstream station, indicating low suction 
pressure below 25 psig. In response to the low suction pressure, the Marshall station 
entered into a local shutdown initiated by the PLC 14 to protect the pumps. Operator Al 
received a notification over SCADA indicating that the pump at Marshall has stopped. 
Within seconds after 5:58 p.m. the low suction pressure alarm cleared. These alarms were 
acknowledged by Operator Al and disappeared from the unacknowledged alarm log 
display but remained in the historical SCADA data. 
See Attachment [29] 15 

Also according Enbridge SCADA data log report 16 at 5:59 p.m. Operator Al 
increased the holding pressure at the Stockbridge to 250 psig. However, between 5:59 
p.m. and 6:00 p.m. three additional S-6 high priority alarms were received from the Line 
Pressure Monitor indicating invalid pressures at Marshall. A FACMAN for 5- minutes 

1 7 

MBS alarm was created at approximately 6:02 pm . 

At 6:03 p.m. an S-6 high priority material balance system (MBS) 5-minutes alarm 
was received on Line 6B between Griffith and Marshall on shutdown, according to 
Enbridge this was a leak detection alarm indicating the imbalance has exceeded 5 minute 
threshold. This information was passed to the MBS Analyst A for analysis through Shift 
Lead A2. Prior to the above, at 6:02 p.m. Operator Al called the pig tracker informed 
him he had shutdown at 5:59 p.m. but with a plan to re-start Line 6B at 4:00 a.m. on July 
26,2010. 

At 6:06 p.m. the 5-minutes MBS alarm displayed cleared, this indicates the MBS 
imbalance no longer exceeded the alarm threshold. MBS Analyst A called back Operator 



LPM is the Line Pressure Monitoring System that Enbridge uses for overpressure protection on their 
pipelines 

13 Medium priority alarms appear as S-4 in the alarm and event logs 

14 Programmable Logic Controller 

15 See Attachment : 29 - Marshall Station PLC Pump Shut down 

16 Supervisory Control and Data Acquisition (SCADA) Data Log 

17 See Attachment: 33 FACMAN generation for July 25 & 26, 2010 
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Al and told him he had column separation and that was causing the alarm. Operator Al 
said he is sure it is Marshall and it would probably be there until they start up back at 
4:00 a.m. the next day 18 . MBS Analyst A said he agreed with that. The cause of the 
column separation was not investigated further. However, during this shift, Operator A2 
the mentor to Operator Al according to the interview transcripts stated she was located at 
a console besides the mentee and had to work on some special projects while Operator 
Al was operating the line. But she mentioned prior to the shut down that Line 6B was 
scheduled to be shut in at Stockbridge, then started up and shut down again at Sarnia after 
about one hour to one-half hour of pipeline operation, to avoid shutting down and starting 
up twice which could affect the pipeline they suggested that they shut down the line after 
Stockbridge delivery. 

Shift B July 26, 2010 

During interviews with Operator Al and Operator Bl, Operator Bl stated that he 
was never told of the alarms and low pressures received during the shift A shut down. 
Shift B started at about 8:00 p.m. on July 25, 2010. At this time according to the alarm 
and event logs and transcripts Niles Station had remained on bypass 19 from 6:08 p.m. on 
July 25, 2010 20 . 

At 4:04 a.m. Operator Bl observed Valve 632.89 with unknown state due to loss 
communication as he proceeded to start Line 6B. He told Shift Lead B2 that the Valve 
should not have been operated, but he sent an open command to it in case it decides to 
close back. Shift Lead Bl acknowledged his actions as positive. 
See attachments [2, 6, 31, and 39] 

At 4:12 a.m. Operator Bl called MBS Analyst B told him that on Line 6B he was 
just starting up and had received 5-minutes MBS alarm. He was asked if he had column 

21 

separation then he confirmed it was . MBS Analyst B said he would get back to 
Operator Bl. According to Enbridge in the SCADA Data Log it was 5-minutes, S-6 high 
priority volume balance alarm between Griffith and Marshall. This was an alarm 
generated from the material balance system 22 which indicated the 5-minutes imbalance 
had exceeded the alarm threshold. 

At 4:16 a.m. Operator Bl received a 20 minute, S-6 high priority, volume balance 
alarm between Griffith and Marshall. This alarm was generated from the material balance 
system indicating the 20-minutes imbalance had exceeded the alarm threshold. 

At 4:22 a.m. Operator Bl received a second 5 minute, S-6 high priority, volume 
balance alarm between Griffith and Marshall. This alarm was generated from the material 



While Line 6B was shutdown from 5:58 p.m. to 4:00 a.m. about 75 miles of pipeline was sectionalized 
between valves, and left to drain (leak) out of the ruptured location. 

19 By-pass- This is closing some sectionalizing valves at Niles Station to prevent the In-line inspection tool 
(pig) not entering the station but to continue on the mainline. 

20 Enbridge Control Center Transcripts 

21 Enbridge Control Center Transcripts 

22 Material Balance System - This is same thing as the Leak Detection System according Enbridge. 
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balance system or indicating the 5-minutes imbalance had exceeded the threshold and has 
been in that state for over 10 minutes. 

At 4:23 a.m. Operator Bl called Shift Lead B2 again told him that Menden pump 
had reached 10 minutes since it was started up, and with concerns about pressure, 
thinking another pump would be needed at Menden, but when he noticed slight pressure 
increase at Marshall and thought there was increasing pressure, he concluded additional 
pump would not be needed. 

At 4:24 a.m. Operator Bl called Operator B2 who informed him the line was 
pretty slow and that he maintained the terminal booster pump holding pressure at 150 
psig. Operator Bl said unless Line 6B is leaking, that he thought they must have 
drained 23 it up completely because they were not getting any pressure down the line, 
however, he was going to start the bigger pump at Mendon since they have gotten the 
small unit out of suction at Menden and if Marshall doesn't start reacting then he will 
shut down. 

Between 4:36 a.m. and 4:57 a.m. there were more material balance system alarms 
generated on the SCADA system. This includes; 

• 5 minute, S-6 high priority, volume balance alarm indicating the 5-minutes 
imbalance had exceeded the threshold and has been in that state for over 
10 minutes, 

• 20 minute, S-6 high priority, volume balance alarm indicating the 20 
minutes imbalance had exceeded the threshold and has been in that state 
for over 10 minutes. 

• 2 hour, S-6 high priority, volume balance alarm indicating the 2 hour 
imbalance had exceeded the threshold and has been in that state for over 

24 

10 minutes . 

At 5:00 a.m. Operator Bl called Shift Lead B2 let him know they were not 
gaining anymore pressure at Mendon, but though they were not losing, they were not 
gaining at Mendon anymore, instead it just leveled out. Shift Lead B2 asked him if he had 
sorted it out, but Operator Bl said no, then he told him to give it one more minute. Shift 
Lead B2 asked him if he was doing 1800 cubic meter per hour and he said no about 1500 
cubic meter per hour which he calculated was about 20 minutes at 20.7 miles. Shift Lead 
B2 also called Operator B2 and asked him how much he had added up in per hour, if it 
was up to 260 and he responded 269. Line 6B was shut down at approximately 5:00 
a.m. 

At 5:04 a.m. Operator Bl called Pig tracking Supervisor to let him know they 
have shut down Line 6B due to some technical difficulties. 



Drained - Condition where a pipeline is emptied-out of oil during a prior shutdown. 

24 See Figures 11, 12, and 13 

25 Again about 75 miles of pipeline was isolated between sectionalizing valves, and allowed to leak out of 
the ruptured pipe. 
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At 6:10 a.m. Electrician A called Operator Bl to let him know he was about Niles 
Station and inquired when he would be needed at the station. Operator B 1 told him Line 
6B was shut down, because they were trying to start up but did not get any pressure into 
Marshall and had to be shut down until they could investigate the leak, if a leak. 
Electrician A then asked him if they had phoned anybody at Marshall, but Operator B 1 
said no they were working on it until they could see what was happening first from the 
control center. The interview transcripts of this Electrician indicated he communicated 
with the Marshall PLM shop about the Line 6B conditions. 

During shift B start up of Line 6B at 4:00 a.m. a draft "suspected column 
separation procedure", provided by Operator B3, was used to operate Line 6B longer than 
a company stated procedural 10 minutes. Operator B3 had received and previously used 
the draft procedure provided by Shift Lead A2 in May 2010. 
See attachment [7, 8, & 9] 

At 6:34 a.m. Shift Lead Bl called the on-call Control Center Operation 
Supervisor told him they had some technical difficulties on Line 6B. Shift Lead Bl 
mentioned that they started up Line 6B and it was drained off and quite often they have 
column separation at Marshall and typically have to fill it. That they started Line 6B and 
did not get pressure at Marshall Area for some time but got up to 4 pounds and the 
pressure did not increase. So they pumped in more into the pipeline expecting pressure 
but got nothing. They calculated their numbers looking at draining 632 cubic meters 
roughly. And once they figured they were not getting pressure, and since they got the 
numbers calculated they decided that 600 cubic meter should fill it. He said they had 
shutdown, had put in 600 cubic meters but they took out 270 cubic meters at Marysville 
which does not seem right. The operators and the MBS Analyst B calculated the pressure, 
they could not have put in 1,600 cubic meters to pack the line and nothing came out. As 
they discussed Shift Lead Bl questioned MBS Analyst B why the column separation 
would not have filled if they put in 1600 cubic meter on the startup. But MBS Analyst B 
stated that it went into the line pack because they were pushing it through 137 miles of 
pipeline to get any flow and it was a fairly low pressure on start up. The Control Center 
Operation Supervisor replied by asking "Yeah but typically it's not that much volume, 
right?" 

According to Shift Lead Bl, MBS Analyst B said they were not pumping hard 
enough into the column separation 28 and with more pressure they should be able to 
overcome the pressure difference. He concluded that the bypass at Niles Station for an 
Inline Inspection tool reduced their pressure output and the hill they had to overcome at 
Mendon station could have been the source of their problem. Shift Lead B 1 stated that 



PLM - Pipeline Maintenance 

27 This volume calculation was done using the commodity movement tracking line balance reports. 

28 Column Separation- Depressurization of pipe section with oil vaporizing from liquid to vapor state. This 
normally occurs as a result of excess drain of the pipeline on shutdown and sufficient holding pressures are 
not held across areas of higher elevations to maintain the fluid in liquid form. The section of the pipe at this 
stage contains both liquid and some vapor. This condition remains in a pipeline as long as the pressure in 
the pipeline is less than the vapor pressure of the fluid. And it is typically corrected by increasing the 
pressure of the pipeline above the vapor pressure of the fluid using pump to pressurize oil in vapor phase 
back to liquid form. 
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they should have shutdown a pump and used more pumps at La Porte. Shift Lead Bl 
went on to say that the pressure in Marshall was virtually zero, amounting to about 4 
pounds. When the line was shutdown it was zero pressure at Marshall. Shift Lead Bl 
maintained that putting in a higher pressure upstream of Marshall should solve the 
problem. Shift Lead B 1 partially attributed the column separation to the drain off that 
had occurred during the 10-hour shutdown initiated at 6:00 p.m. the previous day. 

MBS Analyst B was placed on speaker phone to expatiate, to speak with the 
Control Center Operation Supervisor. He stated that the distance being covered and the 
two separate shut downs which had occurred on the line at 5:57 p.m. the previous day and 
5:00 a.m. first shut down that day could have caused much suction and losses in the line. 
After MBS Analyst B explained that there was not enough flow and pressure because of 
elevation changes and friction losses, it was stated that there was column separation, 
everything before Mendon Station was intact but downstream of Mendon it was broken 
and that they needed more pressure upstream of Marshall to overcome the column since 
Niles Station was on by-pass. The Control Center Operation Supervisor asked him 
whether they should try starting again and the MBS Analyst B said yes. The Control 
Center Operation Supervisor told the Shift Lead Bl and the MBS Analyst B his thought 
in saying "Okay, Well, I guess we can try it again. I guess there's two choices here either 
consider it a leak, or try it again?" 29 

Shift Lead Bl told the Control Center Operation Supervisor and MBS Analyst B 
that before they start the pumps again, he thought they should consult the regional 
management. The Control Center Operation Supervisor asked if they should, and what 
the procedures states. Shift Lead Bl reviewed one of the control center operation 
emergency procedures; specifically the MBS Leak Alarm procedure and understood they 
did not need regional management for their decision. The procedure states: 

"If after 10 minutes an analysis of alarm is not complete, shut down the pipeline and 
standby for analysis alarm; execute the MBS valid alarm procedure. If MBS fortifies the 
alarm is false, execute the temporary alarm procedure" 30 . 

The Control Center Operation Supervisor asked the MBS Analyst B "what do you 
call that", and the MBS Analyst B replied "just call it a false alarm" Shift Lead Bl said 
"okay, false alarm procedure and read: 

"If Shift leader, MBS determine that the MBS alarm is temporary, pipeline operator 
continue normal operations. No pipeline shut downs is required or if pipeline was shut 
down, resume normal operation" 31 . 

Control Center Operation Supervisor gave the approval to start Line 6B after the 
discussion with the MBS Analyst B and shift leads. Shift Lead Bl re-iterated "it is just 
one of those things where, you have done couple of things. You start Mendon a little too 
early, didn't get enough pressure there because you came at it a little slower due to Niles 



See Attachment 4: Enbridge Control Center Transcripts 
See Attachment 19 
See Attachment 18. 



12 



Station on bypass, and they drained off 600 cubic meters. They put in 1, 600 cubic meters 
and still haven't seen it, it meant it is either they packed the line somewhere or else put it 
on the ground". Control Center Operation Supervisor said "Yeah", then Shift Lead Bl 
continued by saying "I mean, the MBS alarms states that or they are false due to the 
column separation" then MBS Analyst B said that when they are static, everything seems 
to be intact. 

Thereafter, Control Center Operation Supervisor said he thought they needed to 
start again, but was asked by Shift Lead B 1 if he thinks they needed to start again, as 
doing a normal startup, all over" then he said "Well, I don't know. To me it sounds like 
you need to try it again and monitor it. Like MBS Analyst B said, do it over again. Shift 
Lead Bl said they will need lots of pressure about 300 to 400 pounds (psig) even before 
getting to Niles Stations, and that they would be reaching back to him in about half an 
hour. 

At 6:41 a.m. a caller from Bay City called control center, spoke with Operator B3, 
then asked if they had Line 6B up and running since 4:00 a.m. she said no, that did not 
happen, because of column separations at Marshall and that the issue was trying to fill it 
up, but there was no pressures at the station. She told the caller that they were still 
investigating and that they may possibly have a leak and that they have not sent anybody 
out yet. 

At 7:08 a.m. Operator Bl told Operator B2 they were going to give Line 6B 
another try, but he asked him whether he was serious, then he responded yes. Operator 
Bl asked him to open up and have his holding pressure high. Operator B2 said it was 
already high and he would open up and hold the pressure at 180. According to Operator 
B2 during an interview stated that after much pumping of oil into Line 6B and calculating 
the volume they had at Sarnia that things were not right and the differential was great. 
Operator B2 tried to communicate this to the Shift Leads and the MBS Analyst B that the 
situation they had was not right, but they had different opinions and the suggestion of 
leak by Operator B2 was dismissed 32 . 
See attachment [23] 

At 7:12 a.m. Operator Bl received a 2 hour, high priority, volume balance alarm 
between Griffith and Marshall Pump stations. This alarm indicated that the 2 hour 
imbalance had exceeded the alarm threshold. 

At 7:35 a.m. and 7:36 a.m. Operator Bl received a 5-minute, high priority, 
material balance alarm, and a 20-minute, high priority, material balance alarm between 
Marshall and Sarnia. 

At 7:37 a.m. Operator Bl received a 5 minute, high priority, volume balance 
alarm between Griffith and Marshall Pump station. 



Human Factor Interviews of Operator B2 on January 31, 2012 
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At 7:38 a.m. Electrician B after being informed by PLM shop Mechanics at 
Marshall about the problem on Line 6B 33 called and spoke with Operator B3. He stated 
that he just got a message and wanted to know whether Line 6B was shut down because 
of Marshall, but she said not because of Marshall instead they had a column separation 
and wanted to fill up the column there, and they shut down the pipeline but are trying to 
start it up again to fill it up. 

At 7:42 a.m. Operator Bl received a 20 minute, high priority, volume balance 
alarm between Griffith and Marshall. 

At 7:46 a.m. Shift Lead Bl called Control Center Operation Supervisor told him 
that Line 6B had been running for 10 minutes with a pressure of three psig on the 
Marshall discharge and that there was not enough pressure to close the column 
separation. They discussed that the Griffith station was maxed out in power and that they 
were short of a pump at La Porte Station due to maintenance and that the Niles station 
was bypassed and unable to run because of the In-line inspection tool. They estimated 
needing 120 pounds (psig) just to move from Mendon to Marshall which they believed 
they could manage; however, they needed 350 pounds (psig) to overcome frictional loss 
and elevations and may not have enough power. In the end it was decided that Shift Lead 
Bl would call the Control Center Operation Supervisor later. 

At 7:48 a.m. Shift Lead Bl asked Operator Bl if they could start a unit at La 
Porte, but was told no. He then asked if they could run any of the remaining three during 
emergency situation and was told no, however, it could be started if Shift Lead B 1 
wanted it. Shift Lead Bl asked if there was an instruction not to start it, but Operator Bl 
said no, it was due to power problems and for that reason they only gave them one unit to 
run. Shift Lead Bl authorized pump unit U-4 to be started and called for 320 to 330 psig. 

At 7:50 a.m. Operator B3 console team mate to Operator Bl who was busy 
operating other lines, called a Power Supervisor on behalf of Operator Bl on Line 6B. 
She stated they were having problems on the line in not getting the columns together at 
Marshall then asked if there is any way they can get more pressure from the pumps at La 
Porte. According to the SCADA data log report, no additional pump was started from La 
Porte station during the second start up. 

At 7:51 a.m. Electrician B from Marshall Station placed a second call to the control 
center and spoke with Shift Lead B 1 . The electrician stated that he received some 
information about the problem at Marshall Station concerning low pressure and has 
walked the station for leaks but found no oil on ground. Shift Lead Bl stated that the 
control center had figured out that they did not have enough upstream pressure to 
overcome the column separation. And that they have to get another pump at La Porte to 
continue Line 6B running again 34 . Electrician B then said if they needed his assistance he 
should be available at the Marshall Station. 



See Attachment: 27 - Electrician B Interviews Transcripts on July 29, 2010 
34 They could not proceed running the pipeline because they did not get more power to continue. At the 
same time Operator Bl supposes to be the individual managing the power issues. 
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At 7:54 a.m. Shift Lead Bl called Control Center Operation Supervisor told him 
they were just shutting down and did not have enough power to get the column back 
together. Shift Lead Bl said they shall be calling some field personnel to get some power 
by making more units available to get Line 6B running. 

At the same time 7:54 a.m. Operator Bl said to Operator B2 the terminal operator 
"So close it, all my pumps are down, so I don't care. You can close off whatever because 
it's not going to take me down, that's for sure". And since it does not matter and they 
should close off whatever pump because it is not going to change anything. Operator Bl 
stated that there was not enough power even to get oil into Marshall. Operator B2 said he 
has never seen this problem before and that it was interesting. Operator B2 stated that the 
situation looked liked a leak, and Operator B 1 stated that they could pump as much as 
they wanted but could never over pressurize the pipeline. Operator B2 stated that 
eventually the oil has to go somewhere. Operator B2 said that it seemed as if there was 
something wrong about the situation. Operator B2 said to Operator Bl "whatever, we're 
going home and will be off for few days". Operator Bl stated they were not going to try 
this again, not on their shift 35 . 

At 7:56 a.m. Operator Bl called the In-line inspection tool tracker and told him 
that Line 6B was shut down again and that he was leaving in 20 minutes. The operator 
said he did not have enough power upstream with Niles Station bypassed and out of 
operation. 

At 8:02 a.m. Operator B3 called one of the line workers telling him they need to 
get off Line 6B because they were going to start it up. Following this at 8:08 a.m. 
Operator Bl called Operator B2 told him they were going to give Line 6B another try but 
he asked him whether he was serious then he responded yes. Operator Bl asked him to 
open up and have his holding pressure high. Operator B2 said it was already high and he 
would open up and hold the pressure at 180. However, the SCADA data logs and trends 
showed that there was no third attempt to start Line 6B. 

At 8:17 a.m. Technician B called Operator Bl and told him he would be at La 
Porte Station in five minutes. Operator Bl told him they figured out they needed another 
unit at La Porte since Niles Station was bypassed, they could not get enough pressure to 
get oil into Marshall. Technician B told him he had three out of four pumps available, 
Operator B 1 replied that any of the three online would work. 

Shift C July 26, 2010 

At 8:28 a.m. Technician B out of La Porte on Line 6B called control center, spoke 
with Operator CI about the operators need for more pump at La Porte. Operator CI stated 
just haven started the shift and would talk with the Shift Leads or whoever to know what 
was happening. Technician B said he will remain at La Porte and stated there seems to 
have been a vibration shut down on unit U-l, which he had re- set and made available. 



See Attachment: 4 - Enbridge Control Center Transcript at 07:54 a.m. 
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At 8:36 a.m. Shift Lead C2 called Control Center Operation Supervisor, and left a 
voicemail message that they needed his attention urgently because at La Porte they 
required power and have problem moving oil from Mendon into Marshall, and 
temporarily required two units for an hour from La Porte. 

At 8:46 a.m. Shift Lead CI asked Operator CI what was going on in his console, 
in turn Operator CI inquired from him what the plan was for La Porte Station because 
they cannot run two pumps at the station. The Shift Leads asked him about the sequence 
he normally follow during startup and Operator CI stated normally bypassing every other 
station along Line 6B. 

At 9:49 a.m. Shift Lead C2 called Electrician B at Marshall and told him they 
started up on July 26, 2010 but there was column separation at Marshall and they could 
not get the line filled. When the control center looked into the trends from the previous 
day they saw that there was adequate pressure along Line 6B up to the shutdown on Shift 
A. However, beginning around the time of the shutdown, pressure at Marshall went to 
zero and never came back up. Electrician B replied that when he got to Marshall Station 
the pressure was initially 4 psig and later went to zero. Shift Lead C2 asked the 
electrician if he had seen anything at the station, but Electrician B, said he had checked 
every location within the station and found no leaks. Shift Lead C2 said since he has 
checked that they will reach his management in case walking Line 6B was required. 

At 10:16 a.m. Shift Lead C2 called and reached the Regional Manager, told him 
the problems they were having on Line 6B, and the column separations at Marshall and 
not being able to put it together, how they have started and shut down two times already 
but couldn't fill the pipeline. He described to him about the entire scheduled shut down 
the previous day while going to Stockbridge, startups, and shutdowns on July 26, 2010, 
while going to Sarnia, which they only got up to 4 psig and after calculations they found 
out that over 600 cubic meter had drained off during the shutdown. However, after every 
effort, they couldn't bring the column separation back together at Marshall, they got 
Electrician B at Marshall who checked out the station and reported everything was in 
good condition. Shift Lead C2 stated they reviewed the pressures at the shut down the 
previous day, and noticed that the pressures right when the pumps were shut down, the 
pressures on the suction and discharge went to zero at Marshall, and whenever pressures 
at suction and discharge goes to zero you take a look around the station because 
something must be wrong. Whenever the suction and discharge goes to zero you will be 
checking for a leak, it means something happened at the station, and if all three 
transmitters went to zero at the same time. Shift Lead C2 stated "at this time we are kind 
of at lost, and are checking at more numbers", then said to the Regional Manager "But I 
don't know if you guys need to check out some of the pipeline upstream and downstream 
of Marshall". The Regional Manager asked him "do you want us to check" and stated that 
"I wouldn't think so that it is right at Marshall, it seems there is something else going 
around either with the computer or the instrumentation". And also said "you lost column 
and thing went out of hand. Do you want us to check; right now I am not convinced, we 
have not had any phone call, if it is a rupture someone is going to notice that and smell 
it". 
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Shift Lead C2 said it means they would just continue to look into things at the 
control center, and if they cannot make sense out of the numbers, they would have to call 
the regional management back. The Regional Manager said the control center should call 
them again but he agreed if they wanted to start the pumps again (ready to go again) "if it 
look like the numbers are fitting". And that they have his approval to start again (go 
again). And they should give them a call if they definitely decide to have someone walk 
the line, because they supposed to have heard by now 36 . 

Shift Lead C2 asked Regional Manager whether the Marshall area is populated 
and he stated that though the Marshall area is not much populated, there are always 
people driving around the area. 

At 10:22 a.m. Operator CI came back with analysis of the delivery valve closure 
at Stockbridge during shutdown on July 25, 2010 which Shift Lead CI asked him to 
verify. He told Shift Leads C2 & CI that he found the valve and it seems to have been 
closed during Marshall Shutdown, it was in travel when they issued the pump stop 
command and all these happened at the same time. 

At 1 1:01 a.m. Operator CI explained to the Shift Lead C2 that Operator Al issued 
the command to shutdown Marshall Unit when it went to zero. He stated that Operator 
Al shutdown Niles Station at 5:57 p.m., Mendon Station at 5:58 p.m. and Marshall at 
5:58 p.m. at almost the same time; there was no particular sequence of shutting down the 
pipeline. 

At 11:17 a.m. the Enbridge control center Shift Lead CI received a call on the 
emergency line from a consumer energy gas utility employee reporting of oil on the 
ground downstream of the Marshall station. The caller stated the oil was into the Creek 
and believed it belonged to Enbridge Energy pipeline. That there was lots of oil and that 
they got 20 gas leak calls and had tried to walk the line to see where the pipeline broke. 
Then stated the Creek color was black and he was located at 27 Southern Division Drive 
also called South Kalamazoo. The caller then asked Shift Lead C2 if they had local 
personnel and he responded yes. The caller re-iterated being located at south of Marshall. 
Shift Lead C2 stated that the control center would be giving the Enbridge Energy field 
personnel a call. 

At 1 1:20 a.m. Shift Lead C2 called the Chicago Regional Manager and told him 
they received a call from a Consumer Energy employee who said they had received calls 
from around two miles South of Marshall, near Highway 27 and Division Drive and that 
he had discovered oil on the ground. Then the Regional Manager asked whether it 
sounded like it was their pipeline, the Shift Lead C2 concurred yes. Shift lead C2 stated 
that they were isolating as much as they could. The location was estimated to be between 
milepost 608 and 609 given that the Marshall Station was located at milepost 607. 

At 12:54 p.m. Shift Lead C2 called Regional Manager told him he received a call 
from the field crew that there was oil on ground about quarter to half a mile downstream 



Enbridge Control Center Transcripts at 10:16 a.m. on July 26, 2010 



17 



of Marshall Station. The Regional Manager then said he will be the Incident Commander 
for July 26, 2010, and some other person shall take over the next day, and then agreed 
that Shift Lead C2 and the control center personnel should call the police and follow the 
Enbridge emergency response procedures. 
See attachment [4 & 5] 

E. Pipeline Operations and SCADA Control 

According to Enbridge, pipeline operators are responsible for starting and shutting 
down of various pipeline assigned to them at their console in a particular shift and at the 
same time assists their console pod-mates. 

During start up of pipeline(s), operators' calls on the terminal operators to start 
the booster pump(s) which they need after they have sent commands to open line required 
valves and stations pumps between the terminal(s) and stations they are scheduled to 
operate. Also during shut downs the pipeline operators' call on the terminal operators to 
shut down the booster pumps while they send commands to stop mainline pumps and 
close designated mainline valves. 

At start up and shut down operations, the operators through the means of 
computer with SCADA control capabilities send commands to the respective pumps and 
valves in the field. In addition to a separate computer database that houses the operation 
procedures and for administrative communications not shown in the figure below, the 
simulator console comprises three different monitor screens showing several computer 
window displays for various pipelines. These screens display information such as the 
pumps, MBS, pipelines, unacknowledged alarm panel, historical SCADA data and valves 
displays (see figure 2). But a typical console at the time of Line 6B pipeline rupture 
incident had up to eight smaller sized monitors per console (see figure 2a). 
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Figure 2: Simulated Training Console; operations SCADA screens displaying simulated 
Line 6A & 6B on February 1, 2012, Source: NTSB. 
See Appendix 2 
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Figure 2a: Typical Similar Operators Console on July 25 & 26, 2010 at the control 
center, Source: Enbridge. 
See Appendix 2a 

An Enbridge pipeline operator on this simulated training console (figure 2) 
controls Line 6A & 6B. The operator starting up and shutting down any of the pipeline 
has to monitor each of these screens from left to right: first monitor comprises the two 
tanks screen displays on top, and MBS screen display at the bottom, the second monitor 
comprises two pipelines Line 6A & 6B screen display on top and an unacknowledged 
alarm panel at the bottom, and the third monitor comprises two Line 6A & 6B valves 
screen on top and the historical SCADA data screen at the bottom. 



Controlled on: superior trainer system 1 1 i 



PCS Line 6 



Displays 


Alarms 


Allowables 


Commands 


| 


Reports 


j 


j 











T 



Figure 3a: Main Menu panel on February 1, 2012, Source: Enbridge Energy (NTSB: IR 
351) 

See appendix 3a 
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Figure 3b: Line Control Panel on February 1, 2012, Source: Enbridge Energy (NTSB: IR 
351) 

See Appendix 3b 
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Figure 4: Simulated Marshall Station with pump unit-3 running, on February 1, 2012, 
Source: Enbridge Energy (NTSB: IR 351). 
See Appendix 4 
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Figure 5: Simulated Line 6B Stockbridge tank farm (terminal station) display on 
February 1, 2012, Source: Enbridge Energy (NTSB IR -351) 
See Appendix 5 
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Figure 6: Offline simulated Line 6B shutdown MBS display on February 1, 2012, Source: 
Enbridge Energy (NTSB: IR 351 ). 
See Appendix 6 
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Figure 7: Simulated Line 6B pipeline display leak, on February 1, 2012, Source: 
Enbridge Energy (NTSB: IR 351 ). 
See Appendix 7 
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Figure 8: Simulated unacknowledged alarm panel on February 1, 2012, Source: 
Enbridge Energy (NTSB: IR 351 ). 
ee Appendix 8 



Figure 9: Simulated Line 6B valve display from Griffith to West Sarnia on February 1, 
2012, Source: Enbridge Energy (NTSB IR-351 ). 
See Appendix 9 



Environment Edit View Options 



S2 L6 La Porte Unit U-4 is no longer Hot 



I2012-02-01 11:54:50.60 OPR s? L6 m.p. 743.17 stopping line from stockbridge to Leonard - sect valve 743.17- 



201 2- 


>2-01 




54 


46 


61 


: pcLPMActions : Unable 


to scan station 6MV.. see log for details 










201 2- 






5 4 


46 


5 9 


OPR 


S6 


L6 


M.P. 7 43 


1 7 S 


canning 


tO Confirm that Sect. Valve 743.17- 


6-V 


is closed 






201 2- 






5 2 


49 


35 


OPR 


S7 


L6 


M.P. 7 43 


1 7 S 


LOPPING 


LINE 


from Stockbridge to Leonard - 


Seel 


val ve 743 . 1 7-6-V 


over to 


seconds in 1 


201 2- 


)2-01 




52 


45 


36 


: pcLPMActions : Unabl e 


to scan station 6MV.. see log for details 










201 2- 






5 2 


45 


34 


OPR 


S6 


L6 


M.P. 7 43 


1 7 S 


ranni ng 


to C 


-jnfirin that Sect. Valve 743.17- 


6-V 


is still in Trave 






201 2- 






5 1 


45 


32 


OPR 


S7 


L6 


M.P. 7 43 


17 S 


^cti ona" 


i zi n 


g Valve 743.17-6-V is now in Tr 


ave" 








201 2- 


)2-01 




43 


39 


1 . 


SYS S4 


Process 


pcCo 


itrol Pi t 


t #0 


has died unexpectedly and may 


not 


have finished its 


process 


ng 


201 2- 


)2-01 




43 


1 3 


5 . 


SYS S4 


Process 


pcCo 


itrol Pi t 


t #0 


has died unexpectedly and may 


not 


have finished its 


process 


ng 


201 2- 


)2-01 




42 


4S 


9 . 


SYS S4 


Process 


pcCo 


itrol Pi t 


t #0 


has died unexpectedly and may 


not 


have finished its 


process 


ng 


201 2- 


)2-01 




31 


35 


57 


OPR 


S2 


L6 


La Porte 


Un 


it U-4 


s no 


OFF (Hot Unit) 










201 2- 


)2-01 




28 


35 


42 


OPR 


S4 


L6 


La Porte 


Un 


it U-4 


s in 


sequence OFF 










201 2- 


)2-01 




25 


1 6 


58 


OPR 


S4 


L6 


Napervi 1 " 


e Lo 


'■> : ;;,>:: 1 :>: 


n Pr 


sssure alarm CLEARED 










201 2- 


)2-01 




22 


05 


37 


OPR 


S4 


L6 


Napervi 1 " 


e Lo 


'■> Sue tit 


n Pr 


assure 










201 2- 


)2-01 


1 


28 


37 


64 


OPR 


S2 


L6 


Lockport 


Un 


it U-2 


s no 


1 onger Hot 










201 2- 


)2-01 


1 


00 


26 


75 


OPR 


S2 


L6 


Mokena 


Un 


it U-2 


s ON 












201 2- 


)2-01 


09 


58 


46 


93 


OPR 


S2 


L6 


Wal worth 


Un 


it U-3 


s no 


1 onger Hot 










201 2- 


)2-01 


09 


58 


37 


63 


OPR 


S2 


L6 


Lockport 


Un 


it U-2 


s no 


/J OFF (Hot Unit) 










201 2- 


)2-Q1 


09 


58 


31 


28 


OPR 


S2 


L6 


Waterl oo 


Un 


it U-2 


s no 


1 onger Hot 










201 2- 


)2-01 


09 


58 


31 


27 


OPR 


S2 


L6 


Vesper 


Un 


it U-4 


s no 


1 onger Hot 










201 2- 


)2-01 


09 


58 


31 


27 


OPR 


S2 


L6 


Vesper 


Un 


it U-3 


s no 


1 onger Hot 










201 2- 


)2-01 


09 


58 


31 


22 


OPR 


S2 


L6 


Stone Lak 


e Un 


it U-2 


s no 


1 onger Hot 










201 2- 


)2-01 


09 


58 


31 


22 


OPR 


S2 


L6 


Stockbr i c 


ge U 


Tit U-4 


is n 


o longer Hot 










201 2- 


)2-01 


09 


58 


31 


22 


OPR 


S2 


L6 


Stockbr i c 


ge U 


Tit U-3 


is n 


o longer Hot 










201 2- 


)2-01 


09 


58 


31 


22 


OPR 


S2 


L6 


Stockbr i c 


ge U 


Tit U-2 


is n 


o longer Hot 










201 2- 


)2-01 


09 


58 


31 


22 


OPR 


S2 


L6 


Stockbr i c 


ge U 


Tit U-1 


is n 


o longer Hot 










201 2- 


)2-01 


09 


58 


31 


20 


OPR 


S2 


L6 


Shel don 


Un 


it U-3 


s no 


1 onger Hot 










201 2- 


)2-01 


09 


58 


31 


20 


OPR 


S2 


L6 


Shel don 


Un 


it U-2 


s no 


1 onger Hot 










201 2- 


)2-01 


09 


58 


31 


1 6 


OPR 


S2 


L6 


Rio 


Un 


it U-3 


s no 


1 onger Hot 










201 2- 


)2-01 


09 


58 


31 


1 6 


OPR 


S2 


L6 


Rio 


Un 


it U-2 


s no 


1 onger Hot 










201 2- 


)2-01 


09 


58 


31 


1 6 


OPR 


S2 


L6 


Portage 


Un 


it U-2 


s no 


1 onger Hot 










201 2- 


J2-Q1 


09 


58 


31 


1 3 


OPR 


S2 


L6 


East Supe 


ri or 


Unit Li- 


2 is 


no 1 onger Hot 











Figure 10: Simulated historical SCADA data display for console on February 1, 2012, 
Source: Enbridge Energy (NTSB IR -351 ). 
See Appendix 10 
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F.O Procedures and Operations 



F.l The 10-minute rule 

The 10-minute limit is required in several operations procedures and was also 
utilized in the control center MBS leak alarm, and suspected column separation 
procedures and is referred to in the control center as the "10-minute rule." 
The 10-minute limitation was first adopted by Enbridge following a March 1991 
accident that resulted in a 40,500 barrel release of crude oil in Grand Rapids Minnesota 
that polluted a tributary of the Mississippi River and resulted in clean up costs of $7.5 
million. In the 1991 accident, the Edmonton control center had continued to operate the 
34-inch line 3 for over an hour after seeing an increase in pump power at 12:20 p.m. 
(CST). Believing that the condition was related to column separation and instrument 
error, the control center continued to pump into the ruptured line until approximately 1:31 
p.m. when the line was shut down. The 1967 segment had failed due to fatigue cracks 
located in the heat affected zone at the toe of the double submerged arc weld. 

As part of Enbridge' s stipulation to PHMSA, a revision to the Operation 
Maintenance procedures manual was adopted by the control center stating that, "If an 
operator experiences pressure or flow abnormalities or unexplainable changes in line 
conditions for which a reason cannot be established within a 10-minute period, the line 
shall be shutdown, isolated and evaluated until the situation is verified and/or corrected." 
As part of the procedure the operator was required to review historical line data to check 
for conditions that may indicate a leak. The procedure further noted that neither a pump 
configuration nor rate should be changed until operator is reasonably certain that leaks 
actually exist or within 10 minutes, whichever was shorter. During the 2010, accident on 
Line 6B the control center had identified areas where more power could be added to 
increase pressure and volume into the pipeline. Additional pumps at the La Porte station 
had been identified for possible operation; however, a start command issued by the 
control center was unsuccessful and the additional pumps were not put into service 38 . 

F.l.l Operations 

According to Enbridge during Line 6B operation the operator has at least eight 
screens and panels (figure 2a, 3 to 10) in addition to the computer system for procedures 
database available to them in the control of the pipeline. While the pipeline is on start up, 
in operation and on shut down, if the operator receives an MBS alarm and any other 
system alarms from medium to high priority between S4 to S8, it registers on the 
unacknowledged alarm panel and the historical SCADA data screens and remains at 
those locations until acknowledged by the operator. After these categories of alarms are 
acknowledged it remains on the historical SCADA data screen but it disappears from the 
unacknowledged panel. However, there is another low priority alarm of S2 to S3 which 
does not appear on the unacknowledged panel but registers and remain within the 



Enbridge was operating as Lakehead Pipe Line Company at the time 
Attachment: 32 Source of 10-minute rules 
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historical SCADA data panel. Also when an MBS alarm clears, a message is sent to the 
operator. 

According to Enbridge from medium to high priority alarms are audible and visibly 

colored differently, while the low priority alarm does not display any of these 

characteristics. 

See Attachment [10] 39 

F.2 Operations 

F.2.1 Suspected Column Separation and Abnormal Operating Conditions (AOC) 

According to Enbridge approved suspected column separation procedure which 
states that "a pipeline operator is to notify the shift lead whenever a suspected column 
separation alarm is received, but if the column cannot be restored within 10 minutes, 
then shutdown the specific pipeline, sectionalize 40 the line valves and isolate the pipeline. 
This is followed by the operator executing the abnormal operations condition reporting 
procedures. This also requires that the shift lead execute the emergency notification 
procedure, and if field personnel locate a leak, the shift lead should initiate the confirmed 
leak procedure, and field personnel verification procedure. If field personnel do not 
locate a leak, then a permission to restart the line may be granted only by the Pipeline 
Control on-call designate". 

Enbridge Energy defined Abnormal Operating Conditions as: a condition that 
may indicate a malfunction of component or deviation from normal operation that may; 
indicate a condition exceeding design limits, or result in a hazard(s) to persons, property 
or the environment. 

The lists of AOC's stated by Enbridge Energy are currently the following: 

• Pipeline Obstruction 

• Suspected Overpressure 

• Suspect leak 

• Confirmed Leak 

• Site Emergency Alarm 

• Suspected Column Separation 

• Communication Failure 

• SCADA Field Equipment Malfunction 

• Station Lockout 

• Valve Malfunction 

Attachment [37] 



Attachment 10: Enbridge Control Center Recorded Simulated Demo on February 1, 2012 
Sectionalize means closing off specific valves to stop backflow into a section of a pipeline. 
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Operator Al on July 25, 2010 from his console with simultaneous running of 
pipelines 6A, 6B, 3 and 17, on shut down of Line 6B after initiating a stop pump 
command at approximately 5:55 p.m. at Menden station noticed a reduction in pressure, 
reacted with an increased pressure at Stockbridge the delivery location to avoid column 
separation and excess draining, at Marshall within seconds of sending pump stop 
command received a 5-minutes MBS alarm which according to the operator during 
interview on July 28, 2010 stated it was audible, visibly red colored, and high priority 
alarm of S8, but according to the historical SCADA data log received from Enbridge it 
registered as S6. Operator Al reported to the Shift Lead A2 who called in MBS Analyst 
A for analysis. Operator Al after completing the shutdown received a call from MBS 
Analyst A who stated there was column separation, which both agreed was at Marshall. 
Operator Al said the column would remain there until the start up at 4:00 a.m. the next 
day. The 5-minutes MBS alarm was said to have cleared from the alarm panel by itself. 
Neither Operator Al and A2, nor MBS Analyst A investigated the cause of the column 
separation. 

According to Enbridge a typical MBS leak screen Operator Al could have seen is 
as in figure 6 but the operators are not adequately trained to conduct analysis from it, it is 
the responsibility and expertise of the MBS Analyst. The MBS screen display the; 
elevation, pressure, and standard flow. But Operator Al and Operator A2 at the consoles 
had other sources of information on Line 6B screen displays to review the cause of the 
stated column separation, such as the historical SCADA data (figure 10), and Line 6B 
pipeline displays. According to Operator Al interviews the historical SCADA data 
display was not reviewed because the operating conditions were interpreted as not being 
abnormal. 

See Attachment [10] 



According to Enbridge AOC procedure after an operator notifies the shift lead, the 
operator is required to enter the AOC or MBS indicator activated into a facility 
management database, normally referred as FACMAls 1 by Enbridge. Operator Al stated 
in an interview to have failed to document these because the conditions were not seen as 
abnormal, but verbally informed the in-coming Operator B 1 about the occurrence of 
MBS alarms and Niles Station bypass. However, 5-minutes MBS alarm was created in 
the FACMAN 42 during shift A, but no other AOC's that occurred was entered. According 
to Operator A2 during an interview she stated being pre-occupied with a different project 
during the shift while Operator Al (mentee) was operating the pipeline. Operators A2 
further stated that "I have complete confidence in Operator Al ability to operate the 
pipeline as well or even better than I can" 43 . 
See Attachments [1, and 12] 



FACMAN: This is a database available to the operators to record all MBS and abnormal operating 
conditions encountered during shift period. 

42 Attachment 38: FACMAN created on July 25 & 26, 2010 

43 See - Operator A2 interview transcript on July 28, 2010 
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On July 26, 2010 at 4:00 a.m. Operator Bl observed Valve 632.89 with unknown 
state due to loss communication as he proceeded to start Line 6B. He told Shift Lead B2 
that the valve should not have been operated, but he sent an open command to it in case it 
decides to close back. Shift Lead B2 acknowledged his actions as positive. The status of 
this valve constituted an abnormal operation conditions with communication fail, had 
intermittently remained in Enbridge system since July 22, 2010 and did not clear until 
August 4, 2010. None of the operators that operated Line 6B through those dates created 
a FACMAN 44 for it. 
See attachments [6, and 39] 

Operator Bl, B2, and B3 started Line 6B, received MBS leak alarms. Operator Bl 
notified the Shift Lead Bl, B2 then Shift Lead B2 assessed it with MBS Analyst B who 
attributed it to column separation which was another abnormal operation conditions, they 
called it temporary MBS alarms 45 . Shift Lead B2 followed the draft suspected column 
separation procedure going over one hour before shutdown of Line 6B. 

The draft column separation procedure in contrast to the approved version stated 
above 4 , in addition includes a new segment that states; "if a starting up into a known 
column separation; pipeline operator notify shift lead, calculate the amount of volume 
drained, and calculate a restoration time to restore the column separation. Then shift 
lead should confirm calculated restoration time with Pipeline Operator, request operator 
to start up into the column separation starting the 10 minutes rule when the calculation 
restoration time expires. If the column cannot be restored under the above conditions, 
request the operator to shutdown, sectionalize and isolate, and execute the emergency 
notification procedure 47 ". This draft procedure was used in May 2010 and was pulled by 
Operator B3 and offered to Shift Lead B2. The draft procedure contains a section 
requiring the calculation for the amount of volume required to fill up the column. To do 
this Shift Lead B2 used the commodity movement tracking line balance reports in an 
attempt to quantify how much volume was lost during the shutdown and start up in order 
to calculate an expected time to bring the column together. This section of the procedure 
was followed after ten minutes which time the column separation was not filled in and 
continued until the pipeline first shutdown at approximately 5:00 a.m. for further analysis 
and communication with Control Center Operations Supervisor. 
See Attachment [14 and 15] 

The operation personnel did not consider or recorded these MBS alarms and 
column separations as abnormal operating conditions and neither were these considered 
as leak. The AOC procedure 48 was therefore never followed and so leak triggers were 
never considered. 

During a latter interviews Operator Bl stated never reviewing pipeline trends 
(figure 6 & 7) and the historical SCADA data (figure 10) to know what was going on 



Attachment 39: Valve 632.89 Communication Fail without FACMAN (facility management) 
See Attachment 18: MBS Leak Alarm -Temporary Alarm 
F.2.1 paragraphs 1 
See Attachment 17 
See Attachment [12] 
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with Line 6B due to overwhelming workload of simultaneous operation of other lines 6A, 
3, and 17 at his console, but however, expected that the Shift Lead Bl, B2 and MBS 
Analyst B should have looked at them since they were involved in investigating the 
conditions. Shift Lead Bl stated not being involved from the beginning of the diagnosis 
of Line 6B problems and had no knowledge of the use of a draft procedure but was 
involved in the second start up and communicating the conditions to the Control Center 
Operation Supervisor. Shift Lead B2 stated they reviewed the trends and the historical 
SCADA data, but only investigated back to the beginning of their first pipeline start up at 
4:00 a.m. and never extended this search to the period covering shutdown from the 
previous day 49 to have seen the leak triggers at Marshall. 
See Attachment [16] 



F.2.2 Column Separation at Rupture Location, Marshall - Michigan 

According to Enbridge in the 12 months prior to the July 17, 2009 of self imposed 
pressure reduction there were no MBS alarms attributed to column separations on Line 
6B. However, in the 12 months following the self imposed pressure reduction there were 
three MBS alarms attributed to column separation. And the location of the column 
separations was downstream of Stockbridge Terminal for each of the alarms. The table 
below lists the date of occurrence, MBS Alarm Section, Alarm Type and Column 
Separation location for each of the MBS alarms. 



M 


BS Alarm History, July 17, 2009 - July 17, 2010 


Date 


MBS Alarm Section 


Alarm Type 


Column Separation 
Location 


27-Jun-2010 


MRRW 


5-Min, 20-Min 


Downstream 
Stockbridge, 
Leonard Valve Site 


28-Apr-2010 


MRRW 


5-Min, 20-Min 


Downstream 
Stockbridge 


18-Oct-2009 


MRRW 


5-Min, 20-Min 


Marysville Area 



Table 1: Summary of MBS and Column Separation alarms from Marshall, Source: 
Enbridge 



From the above summary as presented, Marshall, Michigan has not typically been 
noted for column separation. Notwithstanding, at times according to Enbridge when Line 
6B was shut down, column separations have occurred downstream of Stockbridge 
between Howell and Sarnia. And since column separation is said to occur due to 



See Human factor interviews on January 31, 2012 
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elevation change, Marshall Area at the same time does not have any appreciable elevation 
changes at that location 50 . 
See Attachment [13 and 20] 



G.O. Material Balance System (MBS) Support and Analysis 
G.l. MBS System 

Enbridge uses a computation pipeline model (CPM) for detecting leaks on Line 
6B. The type of CPM used by Enbridge is known as a Real Time Transient Model. The 
model is comprised of computer based hydraulic model that includes all of the critical 
hydraulic details of the pipeline. Design of this includes knowing information of the 
pipeline such as pump station parameters, pipeline inside diameters, lengths of pipe as it 
changes, elevations, locations of transmitters and line-valves mileposts 51 . This hydraulic 
model is connected to the Enbridge Commodity Tracking System and SCADA system to 
import the actual operating pressures, flows and crude oil properties within the pipeline. 

The material balance system uses this information to calculate; validate the flows 
and pressures on the system. The material balance system compares its expected flows 
and pressures to those reported through the SCADA flow meters and pressure 
transducers. If the material balance system finds a discrepancy in the flows then it 
generates an alarm. The MBS system utilizes three separate thresholds of detection. 
These are a 5 minute 52 , 20 minute 53 and 2-hour alarm 54 . The flow imbalance threshold is 
larger for each corresponding time limit. At 5-minutes the flow imbalance must be 
approx. 50 m A 3, at 20 minutes the flow threshold is approx. 100 m A 3 and at 2-hours the 
flow imbalance must reach approx. 300 m A 3 in order to trigger the alarm. 
See Attachment [21] 



50 See Attachment: 20 - Elevation Changes 

51 See Attachment 22 - Interviews of Enbridge MBS Engineer 

52 See Figure 1 1 

53 See Figure 12 

54 See Figure 13 
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Figure 12: Shows Griffith to Marshall 20-Minutes Alarm Imbalance, Source: Enbridge 
Energy. 
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Figure 13: Shows Griffith to Marshall 2-Hour Alarm Imbalance, Source: Enbridge 
Energy. 

The CPM in use by Enbridge for leak detection is based on the Stoner Pipeline 
Simulator (SPS) software 55 . The software has been developed and customized by 
Enbridge as the material balance system (MBS). The MBS system being used in 2010 
was first installed in 1996. The MBS system was upgraded in about 2003 according to 
Enbridge MBS engineer 56 . Line 6B is divided into two separate volume balance sections 
for leak detection purposes. 
See Attachment [22 & 24] 

When an MBS alarm is received at a control center console it is reported to the 
MBS analyst for review. The MBS analyst uses multiple screens at least as shown in the 
simulated screens (see figures 6, 11, 12, 13, 14, 15, 16, 18, 19, 20, 21, & 22) to determine 
the location of the imbalance and to know whether the hydraulic model is working 
properly. If the model appears to be working properly and the parameters within the 
model look correct then the alarm condition is determined to be valid. Since the model is 



Stoner Model: This is the vendor that Enbridge uses their leak detection model. 
Interviews of Enbridge MBS Engineer on July 30, 2010 
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based on the crude oil being in a liquid state, the alarms are considered to be invalid when 

57 

a condition known a column separation appears on the pipeline. Column separation as 
stated earlier is a condition typically associated with large changes in elevation but will 
occur anytime the line pressure drops below the vapor pressure of the crude oil. When 
the vapor pressure drops below that of the crude oil, the pipeline is filled with a mix of 
both liquid and vapor which can render the hydraulic model unreliable. The use of the 
material balance system is to detect the presence of system leaks. While the operators 
have access to the same material balance screens that the MBS analysts do, as stated 
earlier they are not adequately trained to perform analysis, but it is the responsibility of 
the MBS analyst. According to interview statements from several operators they are not 
comfortable using the MBS screens and discerning the information provided. Analysis of 
the material balance alarms is left to the MBS analyst. 
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Figure 16: Line 6B Offline Simulated Column Separation - NTSB/PHMSA IR 358, 
Source: Enbridge NO. 152231 
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Figure 1 7: Line 6B Display Simulated Leak - NTSB/PHMSA IR 358, Source: Enbridge 
No. 162530 
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Figure 18: MBS Line 6 Density, Pressure and Liquid Fraction Simulated - NTSB/PHMSA 
IR 358, Source: Enbridge NO. 165839 
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Figure 19: MBS Diagnostic Flow Summary - - NTSB/PHMSA IR 358, Source: Enbridge 
NO. 172945 
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Figure 20: Line 6B MBS Temperature, Pressure, and Density - NTSB/PHMSA IR 358, 
Source: Enbridge NO. 17393 5 




Figure 21: Rio - SCAD A Trend Simulated - - NTSB/PHMSA IR 358, Source: Enbridge 
NO. 123 119 
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Figure 22: MBS Marshall Pressures - NTSB/PHMSA IR 358, Source: Enbridge 
NO. 1709 50 

The MBS Leak Alarm - Analysis by MBS Support procedure required that if 

58 

after 10-minutes , the analysis of the alarm is not completed or the alarm is valid then 
the pipeline is shutdown 5 . At the time of the analysis during shift A on July 25, 2010 
Line 6B was already being shut-in. 

Reviewing the cause behind an MBS alarm on this above date MBS Analyst A 
stated that he followed an MBS alarm flowchart to determine the cause of the MBS 
alarm. But MBS support response flow chart 60 required the MBS analyst to examine the 
diagnostic flows and all flow and all pressure trends before determining a column 
separation. If a liquid fraction was present, then the MBS analyst was to contact the shift 
lead and tell them that the model is showing column separation but that it was not 
reliable. The flowchart states that the MBS analyst was to tell the shift lead that it is the 
control center operator's decision to start the line. However, MBS Analyst B stated that it 
was the operator's job to examine the pressures. 



Referred to as the 10-minute rule in the Enbridge Control Center 

See Attachment 35: MBS Leak Alarm -Analysis by MBS Support procedure 

See Attachment 36: MBS Support Response Flow Chart 
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These pressure trends and diagnostic flows according to the MBS response flow 
chat contained enough leak triggers to confirm the leak at the time of the rupture if 
followed. 

On July 26, 2010 at approximately 5:00 a.m. Shift Lead Bl reached the Control 
Center Operation Supervisor to let him know the problems the operating personnel were 
having on Line 6B. MBS Analyst B, Shift Lead B1&B2 who supposedly had reviewed 
the abnormal situations that were occurring on the line after 4:00 a.m. start up and shut 
down, had diagnostic control center screens available to them during the investigations. 
But though they reviewed the trends and historical SCADA data they did not notice the 
low pressures at Marshall. 

According to Enbridge the MBS Analyst B had the opportunity of seeing the 5- 
minutes, 20-minutes, and 2-hours MBS alarms screens displays (figure 11, 12 & 13) 
showing how long the imbalances on the line had remained, and the volume of crude lost 
that could not be accounted for after pumping much oil into the line and received less or 
nothing at the destination locations. At the time Shift Lead Bl & B2 with MBS Analyst B 
performed their analyses and calculations, MBS Analyst B had seen the modeled liquid 
fraction (figure 18,) , the hydraulic profile with indications of column separation (figure 
16), low density flow rate had remained as indicated where it existed, and the diagnostic 
flow summary which indicated how long the MBS alarms had remained (figurel8 & 19). 

MBS Analyst B similarly had a display (figure 22) used to review Marshall 
Pressures that had remained dominantly at zero psig, at the same time had display (figure 
20) showing Line 6B MBS Temperature, Pressure, and Density used to review the 
pipeline conditions. These and associated displays both in SCADA and MBS led MBS 
Analyst B and Shift Lead B 1 to state to the Control Center Operation Supervisor that 
these numbers does not look right, but attributed the problems to overcoming changes in 
elevation profile over a significant length of pipeline which led to column separation, 
power and unit outages, and Niles Station bypass leading to lack of enough upstream 
pressure before Marshall station 62 . Enbridge had consequently stated that column 
separation was not typical at Marshall, but at times when Line 6B is shut down, column 

fin 

separations have occurred downstream of Stockbridge between Howell and Sarnia . 

During first start and second Line 6B restart at approximately 7:10 a.m. control 
center personnel had (figure 17) Line 6B display containing pipeline operation data from 
the previous day at shutdown. There were leak triggers available in the (see figure 10) 
historical SCADA data showing: 

• cascaded pump self (PLC) shutdown at Marshall Station and 

• zero suction and discharge pressures on shutdown at Marshall Station 

• pipeline was shutdown with sufficient pressure to maintain minimum 
holding pressure in the pipeline segment 



Liquid Fraction: This is internally calculated model display in the MBS on a distance plot in real time. 
See Enbridge Control Center Transcripts 
NTSB/PHMSA IR NO 40 
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The control center personnel on this shift in their interviews stated they did not 
see the leak triggers. MBS Analyst B, Shift Lead Bl & B2 failed to extend their analysis 
to events preceding the time of the first pipeline startup attempt, according to Shift Lead 
B 2 in an interview. 

Following a recent interviews of Enbridge personnel with a Senior Technical 
Adviser Control Center Operation, Team Lead Leak Detection Assessment & Support, 
and Supervisor Training & Compliance Control Center Operation, who performed 
simulated demonstrations of Line 6B with the occurrence of column separation, and leak, 
which replicated the characteristics of the pipeline similar to the time of the incidents as 
shown in (figures 11, 12, 13, 14, 15,16,18,19,20,21, & 22) above, they think based on the 
simulations that the control center personnel had enough information and leak triggers to 
identify the leak at Marshall, Michigan. But the locations in these simulated displays 
were predetermined for this purpose. 
See Attachment [10] 

According to Enbridge suspect leak pipeline commodity movement tracking 
(CMT) Volume Difference Procedure; which states that in the event of a leak trigger 
from the Commodity Movement Tracking ( CMT) line-fill report, the operating personnel 
are to: verify that the volumes at both the pumping and receiving stations are correct, and 
if the volumes are correct and exceed the Volume Balance Threshold for the pipeline, 
then operating personnel are expected to; initiate a 10 minutes volume check at both the 
pumping and receiving stations; analyze PCS historical data, verify that negative volume 
imbalance was accompanied by a corresponding increase in pipeline pressures. This 
procedure also requires the operating personnel to; compare the volumes from the 10 
minute volume check, and if the difference between the pumped volume and the landed 
volume from the 10 minutes volume check is more than 10%, or if the negative volume 
imbalance was not accompanied by a corresponding increase in pipeline pressure, then 
execute the Confirmed Leak - Pipeline - SCADA or CMT Data procedure. 

During Shift Lead Bl and MBS Analyst B discussions with Control Center 
Operation Supervisor, Shift Lead B 1 mentioned that they started up Line 6B and it was 
drained off and quite often they have column separation at Marshall and typically have to 
fill it. That they started Line 6B and did not get pressure at Marshall Area for some time 
but got up to 4 pounds and the pressure did not increase. So they pumped in more into the 
pipeline expecting pressure but got nothing. They calculated their numbers looking at 
draining 632 cubic meters roughly. And once they figured they were not getting pressure, 
and since they got the numbers calculated they decided that 600 cubic meter should fill it. 
And they had shutdown, had put in 600 cubic meters but they took out 270 cubic meter 
which does not seem right. The operators and the MBS Analyst B calculated the pressure, 
they could not have put in 1,600 cubic meters to pack the line and nothing came out. 

The the operating personnel saw pressures of only 4 psig maximum at Marshall 
during the two starts up and shut down which lasted for over five and half hours, but did 
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not execute the suspect and confirmed leak - pipeline SCADA or CMT Data procedure 
because they did not considered leak triggers such as: 

• zero or low pressure at Marshall Station 

• negative volume imbalance which was accompanied by decrease in 
pressure 

• Multiple consecutives MBS alarms received (active) 

There was no related FACMAN created by shift B operating personnel 
throughout their work period as resulting from abnormal operating conditions except for; 
Line 6B mile post 465.38 densitometer that was not working and a stated suspected rate 
loss which was said made it unable to start Line 6B due to problems at Marshall on July 
26, 2010. 

At start of shift C at approximately 8:00 a.m. on July 26, 2010 Operator CI, Shift 
Lead CI, & C2 according to their statements in the Enbridge control center transcripts 
and interview transcripts were briefed verbally during shift changeover with shift B 
operating personnel about the first and second Line 6B startup and shutdowns, multiple 
MBS alarms received, bypass at Niles station, column separation, pump unit power 
outages at La Porte, and the difficulties for not being able to fill up Line 6B. 

Shift C operating personnel, Operator CI said that what he was briefed during 
shift changeover did not make sense, and then reviewed Line 6B historical SCADA data 
back to the shutdown from the previous day because he was prompted by the amount of 
crude oil drained and to know how the pipeline was shutdown. During this historical data 
review, Operator CI saw a significant pressure reduction at line shutdown, and then told 
and showed it to Shift Lead CI who agreed with the finding. Operator CI said it was a 
leak trigger because it happened at the time Line 6B was shutdown. Operator CI went 
back to his console waited for directives on what next thing to do. Shift Lead CI later 
went over to Operator Cl's console and told him the leak had been confirmed and should 
go ahead to isolate the line 65 . Operator CI told Shift Lead C2 that he thought the line 
pumps were sent stop commands to shutdown at the same time by Operator Al. 
See Attachment [25] and [30] 66 

Prior to receiving an emergency calls at approximately 1 1:17 a.m. about the crude 
oil pipeline leak at Marshall, Shift Lead C2 reached Electrician B at Marshall told him 
the difficulties the control center have had starting Line 6B and requested that Marshall 
Station be checked out for leak, but Electrician B stated haven taken a look throughout 
the station and everything was okay and found no leak. However, Electrician B 
mentioned that he saw the pressure at the station earlier at 4 psig and later it went to zero, 
but was told that because control center tried to start the line and it went to zero after 
shutdown. 



See Attachment: 25; Suspect Leak-Pipeline-From Commodity Movement Tracking (CMT) Volume 
Difference Procedure 

65 Attachment : 28 - Interviews of Operator CI 

66 Attachment: 30 - Suspected Leak - Pipeline -From SCADA Data 
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Shift Lead C2 reached the Regional Manager told him the problems they were 
having on Line 6B, and the column separations at Marshall and not being able to put it 
together, how they have started and shut down two times already but couldn't fill the 
pipeline. He described to him about the entire scheduled shut down the previous day 
while going to Stockbridge, startups, and shutdowns on July 26, 2010, while going to 
Sarnia, which they only got up to 4 psig and after calculations they found out that over 
600 cubic meter had drained off during the shutdown. Shift Lead C2 stated they reviewed 
the pressures at the shut down the previous day, and noticed that the pressures right when 
the pumps were shut down, the pressures on the suction and discharge went to zero at 
Marshall, and whenever pressures at suction and discharge goes to zero you take a look 
around the station because something must be wrong. Whenever the suction and 
discharge goes to zero you will be checking for a leak, it means something happened at 
the station, and if all three transmitters went to zero at the same time. The control center 
continued with further investigations after talking to the Regional Manager. 

The Enbridge control center Shift Lead CI at approximately 11:17 a.m. over 17- 
hours after the rupture received a call on the emergency line from a consumer energy gas 
utility employee reporting of oil on the ground downstream of Marshall Station. Shift 
Lead C2 about 1 1:20 a.m. called the Chicago Regional Manager and told him they 
received a call from a Consumer Energy employee who said they had received calls from 
around two miles South of Marshall, near Highway 27 and Division Drive and that he 
had discovered oil on the ground. 

Again Shift Lead C2 called Regional Manager told him he received a call from 
Enbridge field crew that there was oil on ground about quarter to half a mile downstream 
of Marshall Station. The Regional Manager then said he will be the Incident Commander 
for July 26, 2010, and some other person shall take over the next day, and then agreed 
that the Shift Lead C2 and the control center personnel should call the police and follow 
the Enbridge emergency response procedures. 

H. Pipeline and Hazardous Material Safety Administration (PHMSA) 

H.l. Computational Pipeline Monitoring (CPM) for Liquids 

The U.S. code of federal regulation under 49 CFR part 195.444 refers operators of 
hazardous liquid pipeline transporting liquid in single phase (without gas in the liquid) to 
comply with American Petroleum Institute (API) recommended practice - API 1 130 in 
operating, maintaining, testing, record keeping, and dispatcher training of the system. 

However, scope limitations of this recommended practice may not apply to 
determining leaks during shut-in conditions that occur when the line is shutdown 
(sometime it is called static conditions). For instance, it states that; a Volume Balance 
CPM cannot evaluate volume loss if there is no flow through the meters during a line 
shutdown. 
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API 1 130 also states that no one particular computational pipeline monitoring 
methodology or technology may be applicable to all pipelines because each pipeline 
system is unique in design and operation. Due to this uniqueness detectable limits are 
said to be difficult to quantify as a result of these characteristics on of each pipeline. 
Therefore, API 130 recommends that limits must be determined and validated on system- 
by-system and perhaps a segment-by- segment basis. 

H.2. Control Room Management 

At the time of this accident on July 25, 2010 the control room management, U.S. 
code of federal regulation (CFR) under 49 CFR part 195.446 was published and operators 
had until August 1, 2011 to come into compliance integrating the section to the operator's 
procedures required by 49 CFR parts 195.402. In addition the training procedures 
required by paragraph (h) must be implemented no later than August 1, 2012. 

H.3 Qualification Program 

49 CFR part 195.505 (b & c). This part states that: 

(b) Ensure through evaluation that the individuals performing covered task are qualified. 

(c) Allow individuals that are not qualified pursuant to this subpart to perform a covered 
task if directed and observed by an individual that is qualified. 

This part above consistent with Enbridge Energy procedures places Line 6B 
operating responsibilities on Operator A2 (mentor) during shift A, but she was pre- 
occupied working on assigned special project while Operator Al (mentee) operated the 
lines which comprised lines 6A, 6B, 3, and 17 under his console. 



I. Enbridge Post Accident Actions 

Enbridge Energy currently states that they have multiple proposals for changes 
underway for their system which shall cover the following areas as related to this control 
room and SCADA operations report: 

Pipeline Control Systems and Leak Detection (PCSLD) 

1. Organizational Structure Changes 

2. Process and Procedure Changes 

3. Training Changes - Leak Detection Analyst 

4. Instrumentation Changes 

5. MBS Changes 

6. SCAD A/Pipeline Control System Changes 
Pipeline Control Systems - Control Center Operations 

1 . Organizational Structure Changes 

2. Key Procedures & Process Enhancements 
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3. Control Room Management 

4. Training Development and Enhancements 



See Attachment [40] 
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Attachment 29: Marshall Station PLC Pump Shut down 

Attachment 30: Suspected Leak - Pipeline - From SCADA Data 

Attachment 31: Interviews of Shift Lead Bl on July 29, 2010 

Attachment 32: Source of 10-minute rules 

Attachment 33: FACMAN Generations on July 25 & 26, 2010 

Attachment 34: Line 6B Volume Balance Sections 

Attachment 35: MBS Leak Alarm -Analysis by MBS Support procedure 
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Attachment 36: MBS Support Response Flow Chart 
Attachment 37: List of Abnormal Operating Conditions 
Attachment 38: FACMAN created on July 25 & 26, 2010 
Attachment 39: Valve 632.89 Communication Fail without FACMAN 
Attachment 40: Enbridge Post Accident Actions 

Appendixes 

Figure la: Enbridge Energy Line 6B Active Pump Stations on July 25 & 26, 2010, 
Source: Enbridge Energy. 

Figure lb: Enbridge Energy Pipeline System Map from Edmonton, Canada to Montreal, 
Canada, Source: Enbridge Energy. 

Figure lc: Enbridge Energy Line 6B System Map from Griffith to Sarnia, Source: 
Enbridge Energy. 

Figure Id: Control Room Layout with labels on 2010 

Figure 2: Typical console operations SCADA screens displaying simulated Line 6A & 
6B on February 1, 2012, Source: NTSB. 

Figure 2a: Typical Similar Operators Console on July 25 & 26, 2010 at the control room, 
Source: Enbridge. 

Figure 3a: Main Menu panel on February 1, 2012, Source: Enbridge Energy (NTSB: IR 
351) No. 133814 

Figure 3b: Line Control Panel on February 1, 2012, Source: Enbridge Energy (NTSB: IR 
351) No. 133824 

Figure 4: Simulated Marshall Station with pump unit-3 running, on February 1, 2012, 
Source: Enbridge Energy (NTSB: IR 351) No. 175521. 

Figure 5: Simulated Line 6B Stockbridge tank farm (terminal station) display on 
February 1, 2012, Source: Enbridge Energy (NTSB IR -351) No. 17561 1 
Figure 6: Simulated Line 6B shutdown MBS display on February 1, 2012, Source: 
Enbridge Energy (NTSB: IR 351) No. 144643 

Figure 7: Simulated Line 6B pipeline display leak, on February 1, 2012, Source: 
Enbridge Energy (NTSB: IR 351) No. 162530 

Figure 8: Simulated unacknowledged alarm panel on February 1, 2012, Source: Enbridge 
Energy (NTSB: IR 351) No. 133843 

Figure 9: Simulated Line 6B valve display from Griffith to West Sarnia on February 1, 
2012, Source: Enbridge Energy (NTSB IR-35 1) No. 133920 

Figure 10: Simulated historical SCADA data display for console on February 1, 2012, 
Source: Enbridge Energy (NTSB IR -35 1) No. 133925 

Figure 11: Shows Griffith to Marshall 5-Minutes Alarm Imbalance, Source: Enbridge, 
NTSB/PHMSA IR 1 

Figure 12: Shows Griffith to Marshall 20-Minutes Alarm Imbalance, Source: Enbridge, 
NTSB/PHMSA IR 1 

Figure 13: Shows Griffith to Marshall 2 - Hour Alarm Imbalance, Source: Enbridge, 
NTSB/PHMSA IR 1 

Figure 14: MBS Line 6 Flow Display Simulated - NTSB/PHMSA IR 358, Source: 
Enbridge No. 170255 

Figure 15: Line 6B Offline Simulated Leak - NTSB/PHMSA IR 358, Source: Enbridge 
No. 162536 
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Figure 16: Line 6B Offline Simulated Column Separation - NTSB/PHMSA IR 358, 
Source: Enbridge NO. 152231 

Figure 17: Line 6B Display Simulated Leak - NTSB/PHMSA IR 358, Source: Enbridge 
No. 162530 

Figure 18: MBS Line 6B Density, Pressure and Liquid Fraction Simulated - 
NTSB/PHMSA IR 358, Source: Enbridge NO. 165839 

Figure 19: MBS Diagnostic Flow Summary - NTSB/PHMSA IR 358, Source: Enbridge 
NO. 172945 

Figure 20: Line 6B MBS Temperature, Pressure, and Density Trends - NTSB/PHMSA IR 
358, Source: Enbridge NO. 173935 

Figure 21: Rio - SCADA Trend Simulated - NTSB/PHMSA IR 358, Source: Enbridge 
N0.123119 

Figure 22: MBS Marshall Pressures - NTSB/PHMSA IR 358, Source: Enbridge 
NO. 170950 
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